[icanhasmath]

Fixes for problems that fail CI on every PR into version/0-48-2-RC2. Neither depends on #3868.

Update golang.org/x/net to v0.62.0

The Scan job (Trivy) fails on CVE-2026-78661 and CVE-2026-97045 in golang.org/x/net v0.60.0, both fixed in v0.62.0.
They are in x/net/html, which we don't compile in, but Trivy reports by module version. go get also raises
x/crypto, x/sys, x/term, x/text, x/sync and x/tools to the versions v0.62.0 requires. vendor/ is updated
to match.

Don't search every namespace when publishing a new ingredient without one

state publish <file> --editor outside a project has no namespace until the editor fills it in. Before opening the
editor, Run searched every namespace for the name taken from the file. For a logged-in user that search takes about
55s and then fails with "Could not search for ingredient", so the editor never opens. The first match could also be an
unrelated ingredient with the same name.

The "New ingredient with editor flag" integration test fails on every master nightly for this reason, back to at least
early September.

A new ingredient without a namespace now skips the lookup. confirmRequest still requires a namespace, and
checkNamespaceEdit checks the version once one is filled in. --edit still searches, because it needs the search to
find the ingredient.

Let state publish --editor continue when no editor can be opened

If EDITOR isn't set and there's no xdg-open (common on headless Linux, and the case on the ubuntu-24.04-arm runner),
publish exited with "Could not publish ingredient. Error received: ". It did this even though the notice just
before says the file can be edited by hand. It now says no editor could be opened and waits for the confirmation as
usual. Covered by TestOpenInEditorWithoutEditor, which fails without the fix.

Integration tests that failed only because of the runner or the branch name

• TestPublishBuildEncrypted is skipped on Linux/arm64. It installs into a Python project that state init creates
  without that platform. Integration tests only run on ARM for labelled PRs.
• PerformanceIntegrationTestSuite's teardown stopped state-svc even when its tests were skipped by tag. On macOS, a
  long branch name makes the socket path too long to connect to, so every labelled PR from such a branch failed there.
  It now only stops the service when the Performance tests ran, using a new tagsuite.RunsForTags.

Testing:

• Reproduced the hang with the beta state; the goroutine dump shows it stuck in SearchIngredientsStrict.
• With this change, a logged-in dev build opens the editor right away.
• The publish unit tests pass.
• The PR is labelled Test: publish, so CI runs the publish integration tests.

🤖 Generated with Claude Code